Page 7 of 8~104 min topic

Data: tables and simple plots

Set release boundaries for the study table and plot

Page 7 defines what the study-hours table plus hours-vs-pass plot must refuse before release—security here is not a pasted happy path.

~13 min this pageSafety and operations

1Learn the idea

Read

Threats for this artifact only

Operational risks for the study-hours table plus hours-vs-pass plot center on publishing learner names from the CSV in a shared plot title, plus the earlier failure mode (wrong column names, or a plot that saves without axis labels). Safety lives in executable gates, allowlists, redaction, and a named owner—not in a warning paragraph under an unsafe function.

Read

Run the release gate

Read

refuse to put learner names in plot titles

title='hours vs passed (cohort aggregate)' assert '@' not in title and 'name' not in title.lower() print({'title':title,'pii_in_title':False})


Expected evidence: **pii_in_title False**. A failed assertion means stop, investigate, and do not publish the study table and plot.

Read

Owner, retention, rollback

Name who can disable the feature, what data is retained, and how to roll back to the last known good artifact. Pin the reviewed configuration (versions, thresholds, allowlists) so “what shipped” is reconstructable for data-tables-and-plots.

Read

Lab notebook: release blocker

Write the release blocker as a predicate, not a feeling: “Do not ship the study table and plot if publishing learner names from the CSV in a shared plot title.” Pair it with a passing control that shows the reviewed configuration still works for four-row study.csv with hours and passed columns. Name an owner and a rollback handle (git tag, docs_version, previous image).

Security pages must not paste the happy-path demo. If your gate code looks like the implementation page, replace it with a deny/allow check aimed at publishing learner names from the CSV in a shared plot title.

Read

Worked judgment

State the data retention rule in one line (what is stored, for how long, who can read it). Then state the kill switch (env flag, config pin, or feature owner). The study table and plot is not shippable without both, even when mean hours, max hours, and plot file exists with xlabel/ylabel set looks healthy.

Read

Why this stage matters for the study table and plot

At the safety and operations stage for data-tables-and-plots, the job is narrower than finishing a product demo. You are creating one progressive evidence piece about four-row study.csv with hours and passed columns that later pages inherit without redefining success. Keep that fixture small enough to inspect by hand, keep outputs copy-pasteable as text, and refuse to narrate this baseline as if it were a production SLA: hand-computed mean of the four-row fixture.

For this page specifically, success looks like an executable deny gate for the lab-specific threat while still centering the user decision to inspect typical hours, an extreme value, and the hours/pass relationship. If you cannot point to a file, command, or assertion that proves that for the study table and plot, stay on this page instead of advancing.

Pandas glossary

Previous · Next

Go deeper

Before you start

Why this matters

Write an attack or unsafe misuse specific to this lab: publishing learner names from the CSV in a shared plot title. Predict whether your current code blocks it. Then run the gate below and compare.

In the wild

See how this idea shows up as a product and a company — then come back to the lesson. Skills transfer across vendors.

Check your understanding

Page assessment

Answer from memory. Completion is saved from this evidence, not from opening the next page.

1. Is there a concrete release blocker for: publishing learner names from the CSV in a shared plot title?
2. Are retention and rollback rules explicit?
3. Can the reviewed version be identified after release?
4. Did this page use a security-specific check—not the happy-path demo?

All responses are required.